CVE-2026-69197 Details
Description
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
A vulnerability in the Umbraco Content Management System's Delivery API allows for unauthorized access to protected content properties. This issue affects Umbraco versions prior to 13.15.1, 17.5.3, and 18.0.2. The vulnerability arises because the API does not properly enforce member and Public Access checks on referenced nodes that are serialized through Content Picker or Multi-Node Tree Picker properties. This oversight includes pickers nested within Block List, Block Grid, or Rich Text Editor blocks. When the Public Access feature is enabled, an anonymous user can exploit this flaw to access a protected node's name, route, and ID via an unprotected referencing node, and use the expand parameter to retrieve full property values. Similarly, if the Delivery API is secured with an organization-wide API key, key holders can bypass Public Access restrictions on a per-node basis using the same method. The vulnerability also allows for the circumvention of content-type alias restrictions for referenced content. Direct requests for the protected node will still return a 401 Unauthorized status, but this vulnerability has been classified as a medium integrity risk due to the unauthorized access to protected content properties.
Users can update to Umbraco versions 13.15.1, 17.5.3, or 18.0.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Umbraco | < 13.15.1 (semver) < 17.5.3 (semver) < 18.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |